Operating risks of AI are reflected in wider operating policies and procedures, with specific, clearly written Security Operating Procedures proportionate to risk where needed. The operating environment is watched at a rate suited to the context to confirm the system stays within the ODD, and AI performance is monitored to confirm it stays acceptable against operational requirements; where AI supports important or risky decisions, its output receives additional checks by a relevant subject matter expert. Where AI is intended to be modified, processes keep assurance of acceptable behaviour and ensure changes to risk are understood and managed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.